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(54) NETWORK MONITORING SYSTEM 

(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a network monitoring system 
where an illegal access from an external network to an in-enterprise 
information network can be detected and a transmission source of an 
illegal packet can be retrieved. 

SOLUTION: The network monitoring system is provided with a traffic 
monitoring device 50 that monitors traffic of a packet passing through a 
router 10 and received from an external network 3 and informs the 
router about identification information of an illegal packet at the time of 
detecting the illegal packet and with a disguised server 20 that gives a 
false reply to a sender of the illegal packet. The router 10 identifies the 
illegal packet coming from the external network and transfers the illegal 
packet to the disguised server based on the identification information of 
the illegal packet informed from the monitoring device. 
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w&y"a5fe 1 p 7 f bx^^^ns^ I P 7 F ux • 
Hfta&svtt'f y ? 7 x-xtejES©iso?^-rtB7 l jiHi 

^-zW^n hn;b'ff«^tfti6©7^-;I/F l 
4 8 £#ty D 

[0 0 2 9] [16(4, 7-r;v#yy?T-7>i 5 0© 
fllfiRO 1 \m*to 74)W U y^r-7> 15 0B, 
miEfcl P7FI-X ■ 7^-;VFl 5 1 i:, 3Bit I P7 

FUX-7^-;!/Fl 52 mmftl P7FI/X-7 
1 5 3 fc, £;T«7^-;VF 1 5 4 fcip^ft 
§ 0 ±l27^;u^yy^7 L -7;n 5 oti, E^S5 

0M«§»tai»^'? F 5 0 0%%m 
LftBf, 0©T-7>Waty'a";H 1 OfC 
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[0 0 3 0] H6tffi|^tftX>hUR 1 0 0(4* ^4 
tcm^LTcm^y F 5 0 OOgfiKJSSLTgih* 
tlfc&©?&tK 7-f-;I/Kl 5 1-1 5 3©ftgti, 
±fH»^-y F 5 0 0©1f$8SPfc£S7-f-;l/F* 5 2 
2~5 2 4©ftgk*fjSLT^£ 0 $mNffl<D%£, Hi 
i»@!S7-f-;I/Kl 5 4K(±, SS^- ^2 OffJg^S 

nft^y^7x-x0ssi i coisjgij?3ms£*n5 0 

[0 0 3 1 ] 07H\ fr-l-y^z/jL-fr 12 0©g 

2 0(i, -Y7#7i-X|E]i&l lfr 10 

e>, »^ f 5 o om-<oim<D I P^7"7 F£§ 

#[Lftim«£fu rcf, 5^/^yF©jMfiSI P 
7FbX3 3 l fcjBifcl P7 FbX 3 3 2 
T, 7YW l J^'f-7;H5 0§^l (Xf7 
7l 2 l) 0 ^©ISH, jIMtcI P7FPX1 5 l k 
SSJfc I P 7 F l 5 2 k©ll^±I2»^ >y F k 

-&T5X7 h u * ret* us- K^m-o*^ ft^ti, 

^xyhu©ttS7J0^7'C";l'Ki 5 4*W^y^ 

7i-XTOc§f/^r-y F£fB*L (Xx<y7l 2 2 
~l 2 3) „ COt^a-^TtS. *^SS0S©J§ 20 

£\ 7^;W77x-7VM 5 0tK^x>f*U%fe 

[0 0 3 2] ±f2»^y Fk*ffSTSx> bVffiy 

-5ryh©j65fcl P7KUX3 3 2fcg-3li v C, ^r-f 
77*T-7;M 4 0J&H*t« (7x-y7l 2 4) 0 C 
©i§£, ;b-7 L -Y77x-7;H 4 0©VX^7^-;F 
Fl 4 l^tV7^/^-yt^oT, gf§/*5ryF 
©J&jfcl P7FPX3 3 2&TX7U 8&ftfc8B£W 
47 F UXt" >y h *>W-r-f 77x -7;l/ 1 4 0 ©Jfcfl: 30 
I P7FUX1 4 2fc— a-rSx^MJ (§Wx7F 
U) Sggto SWxybU^Bo^ofc^ti, |x> 
HJ©W^@li7W";I/F l 4 6£W^7£7x-X 
F^Sjgb (Xf-y7l 2 5~ l 2 

6) , m^yhvtpg'Dftzmmi, mm>rv f 

««£*L (Xry7l 2 7) , coTn^i^- 

[0 0 3 3] El 8 li, ttKir^2 0©afl&feS1-7*D 
^A-7a-^-FT*fe5 0 »tf--^2 0ti, ;l> 
-7 1 0^5 I P^7<y F#§MT§k, SM^^ry F 40 
©1f$SgP3 0 0WU »^-y FT^fflLT^S 
771)^-7 a 7©fflgt£lBiJt£ (X7-y72 0 
1) o ftS-9— ^2 0{ctt, ^&§lMi©77y7 
-73 777 F fc*foST*£ S J: 5 746«l5cW©M 
H;l/-f-72 1 0 (2 1 OA-2 1 ON) jWafcLTfc 

^t^jStft77U^-v'3 7©»l'-^7 2 1 0 
fc?g£ft5 (Xry72 0 2 A~2 0 2N) . §{§V^ 
>y FMSLft77U7-73 7©»l/-^7^^ 

o fei^as ^©ffiffl©»v-^7 2 o 3 vgmw 50 
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•yhSansrSo c©*Stt, 0U*fcf, x-^;K££ 

[0 0 3 4] ±fB77Uy-7a 7giJ©Ma^-^72 
1 o H\ S#l$tai, 0 9 fc^-f <fc 9 y F 

ow^i m^yvmm^ryyz 1 1 

k, 7 7>f ;V«*ff«rLT, $ffl77^;t,£#rr£x 

T772 1 2 k, 3V>K^f5Xf772 1 3 

T, ^7C^{g-TSXry72 1 4 k, ^lE^—fk 
051^7-^77^^2 HcWf 3X7^72 
1 SfrSft^WSo 

[0 0 3 5] Ofcfc, ll^lfe±9t, 

^FIEn— if t ©5MIS®^«#f 5 TdbtoT- 777-f 
;12 1 k, *IEa-tf£&< fcftf^ a-if^5©^* 

f«7-^77^^2 2 Sfelr-2tffc^J§£fc 
ife»ft$S7X7A©-9— ^7 (7a~7 j) 
itf;IOf-^l»t § fci6©Sfr-7 7 7^;l/2 

m LTl^S 7 7 <<;l/£ k ±15 2 -o©7-7 7 7 2 
2, 2 3©HflW^ WA(f» ill 0^1-77-^;Fx- 
7;V2 4KJ:oT»iLT^5 a iW, ifelUck^T^ae 
icSffi UTt^S©ft^H^tt©ffi^r- ^ 7 7 
O^Ttt, a©x-^^^©S$»x-^ k LT±IB 
SfHr-77 7^;I/^|fibTfej;i\ 
[0 0 3 6] ±|57 7-r;Fr-7>2 4tt, iJ"-^7* 
StfiSy?2 4 1 k^lSLT, 7 7^7^2 4 2 k, T 
^X^gg (T-^7 7-f;V2 2fe«ttf 2 3) 
7 7^;U£2 4 3 k, r-^©K^Stlfflff82 4 
4k©^%^bT^5 0 ±£Et/c77U7-7 3 7SiJ 
Offi»-fV2 1 0tt3lfS7 7-l';V^Xr^72 

1 2 m ±ia777;Fr-7;l/2 4%#BlfSc:kfc 

ioT, ^il^77F(C^Stl§77^;V^2 4 2 k 
WJS L 7777;V22ft©S77-Y 
t«„ Sft, nv7F^fi : X7 L y72 l 3Tli, ±Kft 
77^;W^LT3V7F^fft§ 0 

[0037] feu ^77^;v^fflf^nri^*^ 

tt, -9— /WJ?2 4 l/)W&^+)--^7©7-7 
777;l/7 1 (7 1 a~7 1 j ) rj^ ^M*x-7^ 
f-^77^2 3fcgILftl, 3WF**ff-r 

^^m^^yvmmi, <mm-w?ft 

3<fc3fcLTt<tV\ C©«#, PAHf, Sg^-^2 
0 *\ m@7t I P 7 F PXSftSiJ--/^ 0 ©7 F bX 
H mt&LkB-C^iErtfr y F S § W©£iW-^ 

7 test stttctot, iia-9— ^ 7 # i&au--^ 

2 O^tcjS^^y F^MtSJcaKLTfet, ±12 



13 

[0 0 3 8] ±3E£ffl§0!im £lfttt$E*7 F7-^ 

fcjctitfs ^iEa-iftt, 7^-feXftfr£-fL £P>L 
HfHfifcSiT? £ 3 fc& 7 ? -feXfcjff2i Lft fe© m 

iot, ^Ea-^©£{f[^^li^£U *©Rfl 
cD5€IB^x-^7 7^;V2 1 fcSfdfctfTtSo 
[0 0 3 9] IKSLftMianH ^^83 3% 

FM\ /^ftlffitT±Efl^*S3 3t 

IS^tirc7^-feX7C^SE4 

mmiLT^m^, mmm4ot)\ *e/^f 

[o o 4 o] m i iz^btcmm-vit. ro^-^© 
xmmzi&m- ^z 007^77^2 1 tc^i- 

mzmnmw 4 0 t £ teut s^stLTfej; 
v\ £©t§^ ^ogis^^T^^E^-^^ifa 

7 n -tx, $ ft i£«^ll£i:fe5{ifBil «fc?tr c: 
ttfT?*Sfti6, ^E7^X©IEiLl$fcLT*iJJlL 

[0 0 4 1] sft, ±mm®m±, mm~^z 0 t 

77-feXMnSM4 0£M*f*§l3 3£fl"LT;l/-# 1 0 

©^7£7x-x[ii£gi l CKg$!LfcfllJ£i:&^T^ 
Stf, ±IBilg^-^2 0 £:7^-txMSffi4 o^n 
|f|57^;7 ■■fe^7F3 lEgEtttTfe«tV\ C©J§£i 
tt, @ 6 ^ Lft 7 7 7*7-7/1/1 5 0©ft7J 
0ii7 -r — ;!/ F l 5 4 fc, ±gBfl^'J 7 • -fe^ > F 
3 l3bW£ft^7*7x-X|s|i®l 1 B©flSiJ?£ 

^LTfc't, 07^Lft;i/"r-Y 77*^7^-/1/ 1 
2 0©7n-?-^-Hc&^T, X7y7l2 37\ § 
M^-yF©%ftI P7FUX£ftg-*r- ;WFW 

Sf*r-^©7KU^ti, Xry7l 2 n?7-f;V*U> 
7"r-7;l/ l 5 0 S L fc B Wxy MJ ©feiMft I 
P7FbX- 7^-/1^1 5 3#^#5n5o 
[0 0 4 2] 111-014 WSStT*^© 

!l2f|ji$J£^Tt^<r3 0 ^UllTOi, )V-r 
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jyV-T-ftol 4 o£#IMLT, gfg^'y F©jI 
€7t7Fb7t7x7 7t§^fcfcJ:^7, /V-710 
fc, ^§gg©7 7^77*-;Ht^fcft€ft(:i:?: 

[o o 4 3] eii ni, mmmizm^-T^yf 

r-7> l 4 0© 1 0ff£^T o /F-r^ y>?T-~Jto l 

4 0©§xyhUii. ]^ff^©I P7Fl^X£vX^ 
§ftfe©^X7^7-7^t7^~;VFl 4 1 fc, ± 

mzz^-yr^^zfttcmmmK i P7 

10 FUX^-r7^-;VK l 4 2 fc, Sffi^y h©7J] 
011 (^v?7i-xffl) ©HS'B^I^-^F 

14 3fc, P7FbX^X^1"§ftfe©^X7 
;^~y£^T7^-/FFl 44 ±13^X7^7- 
77-VX^Snftg^WS^I P7FbX^-T7^ 

-;i/Fi 4 5t, %&ty-vh<Dmm& yy?7x 

— X[e|S&) ©sfJjiJ?^t7^-;VFl 4 6^, JS147 
^-/FF 1 4 7 fc, ^St£i:r7D hn;l/l|©fte©3l 
ir-*tf^£ft£7-f-;FF*l 4 8fc*^ft5<, 
[0 0 4 4] _tfiBJH47^-;FF 1 4 7(±, ^©xyF 

20 u T^g?nft3ifi7cfc^^©ii#^ift^^fi/^ 

ffiTJ0fi7Y-;l/F l 4 6T?jf££ftftm;«t-\©§: 
Sftti, 7^/l^l>77~7-7;M 5 0*W§^ 

[0 0 4 5] HI 2li, ±f2^2SMlJTffiffl?tlS7 

U y9T-7)]/ 1 5 o © l „ *sWJ7- 
30 7^r-7;v©7-r-;V F l 4 l ~ l 4 5 t 

mm<D, mm^^xsmmm^ttz.^<D7 * f 

1 6 1-1 6 5t. &9t<Dl P7FbX^t7^~ 
;l/F 1 6 6 fc, th730S^SCT^t7-f-^F 1 6 7 

tfrfiftoT^S, ±ElsSi5fc7-('-;l'Fi 6 6tc{±, 

Wm-^Z 0©I P7FbX^«5n, tii*0^7 
Y-^F 1 6 7^{±, ±HB0g^-^2 OA^^tlfe 

^>^7x-xieis&i i c©iiBij ; ?*w^n^o 

[0 0 4 6] 01 3t±, ^SSM^feV^T, I^c|l5 
0i^S4fcitffl»^7-; F 5 OO^ILft^lc 
40 l OjbWrSr- 7;Ht a^^a-^l l o© 
7D^7A7n-7^-h^to ;W-^7^x 
-7>1 4 0*^L (X7771 11), 
F 5 0 0©'i$8gP5 2 0tc#gtl§5Mfl7Cl P7FUX 

5 2 2fc^5tl P7KUX5 2 3 Lfcx 
yFU (BWxyFU) ^W^^§^W^T§ 

(X7771 12) o tU gfc>f'J«t§ii 
^©^ii, JRtt7*-;l/K 14 7^ "S^" fcftT^ 
S^S*^W£L (Xr-y7l 1 3) , |£tc «t 
bT^tt, C©;V-77^7T§ 0 
50 [0 0 4 7] iWx>FU©M147Y-^F^ 
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(Xr-^l 1 4) Lfc&, 74j\t9Vy97—7i\/\ 
5 0 fc, J^Sfixv F U £MfST£Srfcfcx:y F U £ 
^lilML (Xf^l 16), C©;V-^y^71- 
So /I/-T-* >^t-7;H 4 OEB^xyFU^tefr 

■pfe^ti, mbwm^y f 5 o ot^oxir/c 

ftxy F y U c ft£;b-x * > ^-r-7;Wci§ 
tM&m (Xr77l l 5) Lftl, Xt?7i 1 6** 
fffSo Mil 04fc*Lfcft&0fiJffl^yF5O 

li, Ell ltM^-rSA^K, 

-/^Ytitr, zti?m*?*ym<DM%*%m 
Ltc^y h u r 2 o i mimmtxT^tm^ 

P7Kl/X©H#&£«Lfcfrfe4xy 
F U R 2 0 2£4j£U cn^x-y^-f-fc^^T 

±t2x> h u r 2 o i ± o feffi^-rstemt^fSo 

[0 0 4 8] ±Eliftax>M)R 2 0 2©A*ll^7 

y-;ff i 4 7tt± "en" 

5. iiiBfr/c&xy F U R 2 0 2 ©iMflTt I P 7 

FUX7^-;|/Fl 4 2fe±tf3a5fel P7FUX7^~ 
;F F l 4 5 fcfi, fflfp/^ 7 F 5 0 0 oSMtc I P 7 F 
I/X7^;l/F5 2 2mmi P7FF-X7^-;b 

K5 2 3^5»i#^n/c7Fbx^^n, ^n^nt 

ftjfc-fSvx^X^l'Fi 4 1, 1 4 4fcli N vx* 
[0 0 4 9] £fc, 01 2tflaj^f5<fc"5t, 7-Y;F£ 

yyxr-7;M 5ottt, u^x, y©i P7Fb 
xk, (s^7Kux («9-A2o) dj^» 

§o **fifi0!l©*§^ fi&Stf-^O I 0O7 

y^7x-x@ssi i ctgEK^nrv^feft, 

fi7-f-^Kl 6 7tCti±f37y^7x-X@SSl 1C 

[0 0 5 0] m 1 4 H\ *Hffi^J{c43^§;l/-^y^ 
5>a-;H 2 0©^a®)ft^1-7n^A7P-^^ 
-F£*to 7>^7x-XS$l 1^6/^-yh*S 
A7JHIi! (7^7x-x@$) ©affigfJ? 
§ffi^7 F ©}MitS I P 7 F UX 3 3 1 ^£ 
I P7 F UX 3 3 2 t ttSoVT, /F- 5V >?t-7 
;M 4 0^^T§ (Xf771 3 1) o v 
x^/^-ytff^nftxy h y ^ ±ta^{i^ i 

P7FUX3 3 1 fcffiftl P7F^X3 3 2£YX^ 

3xr/FU (ifix>MJ) fcfcfgfS. 
[0 0 5 1] 8£©|gjft*«£L (XT771 3 2) , 

/^7 F^JilS (Xf771 3 3) LT, ;:©;!/- y^ 
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F U ©Mtt7 y -;F F 1 4 7 U ltt7 y -;F F 
'W **LT^fd§£{i (XT771 3 4),-* 
^yh*«3ILT (Xf771 3 3) , <l<D)V-?yl£ 
mt% 0 Mtt7^-;FF^ "iW ZmLTWdSfe 
It (Xx77l 3 5), Hi 7J0iT7 ^-;i/F 14 6-pfi 
^$n/c7>^7x-XTOc§ji^^7 h^ffiL 

(Xr77i 3 6) , co;b-^v**l7-r« 0 ±MM 
tt7^-;FF# S^LT^fe*&ti, ±IH;l/- 

7;H 5 0^^L (Xfy71 3 7) , jtl^n/cx 
>FUOffl7J[aUi7^-;l/Kl 6 7*W^>X7x- 
X0Sgtg^^7h^l551 (X7>y7l3 8) Lft 

[0 0 5 2]^, ®m-*2 0 t7^-feX7C^gg 
4 0£flS&*U7 - W>h3 1 fcgMLft^ti, 
±l27^;F^Uy^r-7>l 5 OOtH^Hi^-^ 
F 1 6 7t7>^7x-X@E|l 1 BOKffifffcfiSL 
Tfet, ±I2XT7 71 3 8T% SM^f 
20 P7FbX3 3 2^feJM5tI P7 KUX7-f-^K 5 2 

@®7^-;l/Fl 6 7AWifSy7t^oT, 7>^7 
i-X@| 1 1 Btcgfl/^y F*^ffl-rntf«tl/\ 
[0 0 5 3] 77^7^*-Wi, ;l/-^t®ffiL 

m~^2 0 ^7^^XjC^gg4 0*1 1 lZiFt7 

747 *y*-mw 5 tgcMu g^gm 5 0 ^sm l 

fc»/^-y F 5 0 0*7 7777^--;b5^f|U 
77777^— fr5i>\ ttDmktyXt&^iE/tyy F 
30 £ftg^<2 0Mte£t£$$i:LTfc&V\ 
[0 0 5 4] 

Tti, ^BP^ 7 F 7-^ e. ifelF*3 * -y F 7-^ t^E 
(c7^^Xt§/^>y F*^IE7^^X • F77-f77 

40 fc, to^7 vom$%mm?Tmnfi%xmu 

*IE7*-feX©M££tilltf&5 0 

[iffi©®m4M 

[1 1 ] mm<D%V h7-^I^XrA« 1 

[02] ±8B*? F7-7^>XrAT^ffi?ti§^ 
^ y F 7 * - v 7 F O 1 M*^1" M* 

[03] B 1 fi:SLfc;F-^ 1 0©W£,7t7o7? 
Ho 

50 [84] mn^btzmmms ofrzmmtism 
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tVr v V <07 *- *? y V <D 1 fflfc^TBI. 

o<7)i^Mi»rEio 

[07] ;V-5f 1 oams^-r-rV^^a^M) 
[09] H8Kfe^««ia;i/-^2 l ooEHUfc^T 

[01 0] _h|2^^-/^2 0^«^^77-Y;!/x-7 
;V 2 4 © l M£*t 0 O 

[011] l 0jbTOT«;V— r^yf^-fto 

l 4 0 ©ffioHSHW^f H. 

[01 2] l o^$ffit§7^/H* ! Jy?x-7 

;n 5 o <D\m , m.9m^tm, * 
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¥ [013] offlJ.Sr-TVMSI^a-fl' 
I l 0©{tk<DHMiJ^1"7a^A-7n-^^- 

K 

[01 4] l o^x.§;i/-r^>^ : ev ? ^-;V 
l 2 0tDffi©^M!l^T7n^5A'7D-^^- 
K 

1 : nmmmm. 2 *m->^ 3 : h 

U-t, 5 : 77^77*-mW, 7 8 : 

I 0 : 1 1 : -ry^7x-X 

12: ;l/-r^>^Wm 2 0 : 
>\ 2 2: Mf-?77^/K 4 0 : 7^XtM] 

5 0 : *y F7-^IW 5 3 : £SS^*- 
>l21i7r^;K l l 0 : r-7>f JIti/3.-;k l 

2 0 : ■ f-f y^^a-;K 14 0: ;V-f^ >^ 
r-7;K l 5 0 : 7y;I^V y^r-7*;k 5 0 0 : 
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